Understanding ENS › Hints on Filtering Events and Dispatching Actions

Hints on Filtering Events and Dispatching Actions

You need to be aware of the following points when creating filters, dispatches and action routines:

• A filter determines what events to report.
• A dispatch determines how an event is to be reported, and when.
• A filter can have more than one dispatch. Therefore, you can dispatch an action for an event to more than one destination, and that dispatch can depend on the time of the day and the day of the week.

  See the scenario described in Filtering Duplicate Events in a Group of Systems Depending on the Time, in Chapter 12, “Scenarios for Filtering Events,” for an example of how this can be done.

• You can prevent duplicate events being sent within a specified time. There are two controls that allow you to do this:
  • Filter interval, which allows you to prevent any further events from being dispatched within the specified time
  • Event interval, which allows you to prevent recurrences of the same event from being dispatched within the specified time.

  You can use these controls individually or both together. See the scenario described in the section, Filtering Duplicate Events in a Group of Systems, in Chapter 12, “Scenarios for Filtering Events,” for an example of how this can be done.

• The action name determines the instance for a dispatched event.

  If an action handles only a single event at a time, then you can use that action for more than one filter (the supplied action Mail is an example).

  If an action handles multiple events, then do not use that action name in more than one filter. This will cause ENS to mix up the different, filtered, events.

  However, you can use the same action routine in more than one action.

  For example, if you have two filters that report a different class of events using eventlist, then the action name for each filter must be different. In this case, you would get one class of events reported in one eventlist window, and the second class reported in the other window. If you used the same action name for both filters, then you would get both classes of events reported in the same eventlist window.

  When deciding how to report events, follow these steps:

  1. Decide on what events you need to be reported, such as: all events of a specific class; all events of a certain priority from a specific system; and so on.

     This determines the number of filters that you need to create.

  2. Decide on how you want the different events to be reported (the amount of information and the destination), and when (time of day and day of week).

     This determines the number of dispatches that you need to create for each filter.

  3. Decide on whether or not the supplied action routines can do what you require.
  4. If you need to create an action routine, you must decide on whether the action routine is to handle a single event, or multiple events.